CyberRota Analysis
AI-GeneratedThe vulnerability allows users with the deletecollection verb or wildcard permissions on tier-scoped policy resources to perform bulk deletions of NetworkPolicy and GlobalNetworkPolicy objects, bypassing the intended tier authorization controls. This could lead to unauthorized deletion of critical network policies, potentially disrupting network security and operations. Organizations utilizing Calico for network policy management should prioritize addressing this issue to safeguard their tiered resource access controls.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
Related CVEs
Other vulnerabilities affecting the same vendor(s)